T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:64
- Finding
- Unverified Remote Installer Is Downloaded and Immediately Executed<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:64-69` - `README.md:30-35` - `README-CN.md:29-34` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Shell installer curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash ``` ```powershell # PowerShell installer irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex ``` ### Technical Analysis The installation instructions retrieve scripts from the mutable `main` branch of an external GitHub repository and immediately execute the returned content with `bash` or PowerShell `Invoke-Expression`. The effective executable payload is not included in this project and therefore could not be inspected during this audit. HTTPS protects transport integrity but does not ensure that the repository, maintainer account, branch, or future script contents remain trustworthy. The instructions also provide no immutable commit pin, release version, checksum, or cryptographic signature. Piping network responses directly into an interpreter eliminates the opportunity to inspect the payload before execution. Although installing the CLI supports the declared document-extraction functionality, unrestricted execution of a mutable remote script is not the minimum privilege necessary to install or invoke that CLI. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, or another component capable of changing the `main` branch. 2. The attacker modifies `adp-init.sh` or `adp-init.ps1` to include malicious commands. 3. A user or AI Agent follows the Skill's installation instructions. 4. `curl` or `Invoke-RestMethod` downloads the modified response. 5. `bash` or `Invoke-Expression` executes the response without review or integrity verification. 6. The payload performs arbitrary actions using the privileges of the invoking process. ### Impact Assessmen ...[truncated 798 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and `irm | iex` installation instructions. 2. Reference an immutable release version or full Git commit hash instead of the mutable `main` branch. 3. Download the installer to a local file without executing it: ```bash curl -fL -o adp-init.sh "https://raw.githubusercontent.com/laiye-ai/adp-cli/<immutable-commit>/scripts/adp-init.sh" ``` 4. Publish a SHA-256 checksum through a separately protected release channel and require verification before execution: ```bash echo "<expected-sha256> adp-init.sh" | sha256sum --check - ``` 5. Prefer cryptographic release signatures with documented public-key verification. 6. Instruct users to inspect the downloaded script before manually executing it. 7. Explicitly warn users not to run the installer as root or Administrator unless a documented operation strictly requires elevation. 8. Prefer a versioned package or signed release artifact installed into a user-scoped directory. 9. Ensure the same hardened instructions are applied consistently to `SKILL.md`, `README.md`, and `README-CN.md`. ]]>